# Limit API Rates at the User Level Only

**URL:** <https://forum.buildkite.community/t/limit-api-rates-at-the-user-level-only/4638>\
**Category:** Features Requests\
**Created:** [October 21, 2026, 10:44pm UTC](https://forum.buildkite.community/t/limit-api-rates-at-the-user-level-only/4638 "2026-10-21T22:44:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![william.turner](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.buildkite.community/william.turner/32/1729_2.png) [@william.turner](https://forum.buildkite.community/u/william.turner)\
**Post date:** [October 21, 2026, 10:44pm UTC](https://forum.buildkite.community/t/limit-api-rates-at-the-user-level-only/4638/1 "2026-10-21T22:44:06Z")

</div>

With the advent of AI, individuals now have the ability to generate heavy workloads / queries / etc that can impact service host APIs far more than previously. Buildkite currently has an Org level API rate limit which exposes the company to a material outage if 1 bad actor causes a spike in API access triggering a limit at the Org level.  
This request is to eliminate the Org level rate limit and focus on rate access at the user / token level. This closes the risk exposure at the Org / Company level.

---

<div class="post-metadata">

**Author:** ![Dahtey](https://avatars.discourse-cdn.com/v4/letter/d/7993a0/32.png) [@Dahtey](https://forum.buildkite.community/u/Dahtey)\
**Post date:** [October 21, 2026, 11:31pm UTC](https://forum.buildkite.community/t/limit-api-rates-at-the-user-level-only/4638/2 "2026-10-21T23:31:45Z")

</div>

Hi William,

Thanks for reaching out via our Community forum. We understand your concern and I’d like to clarify that Buildkite supports **per-user rate limits for both the REST and GraphQL APIs** , alongside the organization-wide limit. When a user reaches their individual limit, their requests are throttled; that does not, by itself, throttle other users. Human and machine users can have separately configured limits, allowing different allowances for individual usage and automation.⁠⁠

A few important details:

- Limits apply to the authenticated user associated with the API token, rather than independently to each token. Separate tokens belonging to the same user therefore share that user’s allowance.⁠⁠
- Requests count toward both limits, so aggregate usage can still exhaust the organization’s allowance. Per-user limits provide an additional safeguard rather than replace the shared limit.⁠⁠
- For existing organizations, per-user limits are initially set to match the organization-wide limit to preserve existing integrations. We can help apply stricter per-user limits to reduce the risk of one user consuming the shared allowance.⁠⁠

We’d be happy to review your organization’s current human-user, machine-user, and organization-wide limits with you, and help determine appropriate settings for your workloads.

For more information:

- [Per-user rate limits announcement](https://buildkite.com/resources/changelog/353-per-user-rate-limits-for-the-buildkite-api/)
- [REST API rate limits](https://buildkite.com/docs/apis/rest-api/rate-limits#per-user-rate-limits)
- [GraphQL API rate limits](https://buildkite.com/docs/apis/graphql/graphql-resource-limits#rate-limits-per-user-rate-limit)

Organization administrators can also view the applicable per-user limits under **Settings → Quotas**.⁠

Hope that helps. Let me know if you have any further questions.

Thanks,

Dahtey